Sega Saturn's DRM Cracked Almost 23 Years After Launch

An anonymous reader writes from a report via Gamasutra: The Sega Saturn's DRM has finally been cracked after it hit store shelves nearly 23 years ago in November 1994. Engineer James Laird-Wah first set forth to break through the console's copy protection in an attempt to harness its chiptune capabilities. Laird-Wah has, however, developed a way to run games and other software from a USB stick in the process. Since disc drive failure is a common fault with the game console, his method circumvents the disc drive altogether, instead reworking the Video CD Slot so it can take games stored on a USB stick and run them directly through the Saturn's CD Block. "This is now at the point where, not only can it boot and run games, I've finished just recently putting in audio support, so it can play audio tracks," explained Laird-Wah, speaking to YouTuber debuglive. "For the time being, I possess the only Saturn in the world that's capable of writing files to a USB stick. There's actually, for developers of home-brew, the ability to read and write files on the USB stick that's attached to the device.

Wishful thinking...

[Anonymous Coward]

But I wish every consoles could just run games off a USB stick.
I wouldn't mind having to buy a special type of USB stick just for the console, if it means to just "charge" a game to it at a video game store and play the games from that, for faster load time. Or heck, just to get the "download files" and then transfer the finished product to the internal drive, would be great for people still stuck with a slow network connection, where downloading a 50GB game is just too much.

Re:

[AK Marc]

I would like consoles to work off USB. I can buy a game as DLC, download it and run it off USB. But if I buy the physical game, I can't run it off USB. If I want to use my "favorite 3" and go back and forth between them, I can't install them locally and run them without the physical media in them. I get a better user experience (in an always-connected console) with downloaded games, and a better experience (in a non-connected console) with physical media. It's inconsistent and frustrating.

Re:

[fragMasterFlash]

You would need a USB stick that implemented a secondary device to uniquely identify the USB stick to avoid piracy. Implementing something like ARM TrustZone [arm.com] in a USB secondary function device would seem to suit this purpose nicely. Games downloaded to your USB stick could then only be used when that particular USB stick is physically present on your gaming system.

Re:

[wbo]

Performance depends on the speed of the USB device. Good quality USB 3 flash drives can be read at 300 MB/s or more making them much faster than the traditional hard drives installed in most consoles - not to mention optical drives.

Re:

[AK Marc]

I'm running games off USB just fine on XBone. I just can't run games bought on disk on the USB exclusively. Disks are much slower than USB, and I think systems like XBone test performance of USB and if it doesn't run fast enough, it'll not use it for external storage.

Re:

[AK Marc]

Call home licensing would be fine. Call home licensing on a disk is unacceptable (initial rumors of PS4), but I said nothing that indicated a DRM-free USB was required. I have a USB stick in my console. If I buy a game online, it installs on the USB and plays from the USB. The download game gives more functionality than the disk game. That seems silly.

Re:

[RockDoctor]

Sounds like games are too complex to bother with these days. I'll stick to CIV and Oolite. Oh, and for a change, XCom.

Re:

[Rob MacDonald]

except that the speeds over usb, even usb 3, make trying to use external drives for that type of purpose a complete and utter waste of your time, it will be horrendously slow. The thing is, with a pc, you can do this right now, and you'll see how craptacular it really is. What you are really asking for is a return to game cartridges, which honestly, feels right. We're in a digital download frenzy but not all people have the connection to rely 100% on that, let alone the limited drive space on consoles.

Re:

[Blaskowicz]

The standard for a real SSD in memory card form factor was in the news recently, it's UFS.

About a non-writable SSD : what's that? :)
Your concern about lifespan due to writes is overblown and you can always use flash, but not write to it. Like Nintendo DS games, or your many firmware blobs in your PC that are stored on flash and upgraded never, once or a few times (BIOS/UEFI, hard disk drive firmware, VGA BIOS, etc.)

I agree something read-only and cheap would be great. But games need updates these days (sadl

Re:Huh?

[NotInHere]

He did it without requiring a modchip. If I understood the interview right, he has built a card that can be put into the extension slot which simulates the CD-ROM controller chip. So it essentially fakes a CD-ROM to the OS.

And yes, those devices do have "DRM" of some sort: its a "wobbly" line at the outer border of the CD-ROM which the reader reads. All writeable CD-ROMs have non-wobbly lines. Without a modchip you'll have problems.

Re:Huh?

[twistedsymphony]

I've had a CD-ROM Emulator on my Saturn with no modchip for quite some time now: There are a pair of devices called Rhea and Phoebe [retrocollect.com]. You unplug the CD drive and plug this in it's place, insert an SD card loaded with disc images and that's it.

Re:

[Zak3056]

He did it without requiring a modchip. If I understood the interview right, he has built a card

So he's not using a modchip, he just... built a modchip?

Re:

[_merlin]

Saturn modchips connect between the laser unit and the rest of the CD drive to detect when the system is trying to identify whether a disc is genuine and return the required data. This device plugs into the expansion slot and uploads code to run on the CD block processor the way the VCD playback add-on did. It causes CD block commands to read from the flash storage rather than the optical drive.

Re:

[Zak3056]

Just because his implementation is different than previous modchips does not make this "not a modchip."

Re:

[SumDog]

Did you watch the video? It's pretty drastically different than the traditional mod chips. His implementation requires no soldering of the existing components. The work is also amazing. He gets pretty detailed and shows the dumped assembly code.

Also, existing mod chips still require a functioning CD drive, and those parts are slowly dieing in existing units. His modifications allow reading images straight from a modern data source.

Re: Huh?

[DaHat]

DRM in some form has existed for years... Even the original Nintendo had it https://hackmii.com/2010/01/th... [hackmii.com]

Re:

[alvinrod]

Interestingly back in the day the laws and courts were more sane and it wasn't illegal for companies to circumvent Nintendo's lockout technology and there were a few companies that produced unlicensed games for the original Nintendo. Even more funny, one of the companies that was (in)famous for doing so produced a lot of bible themed games [cinemassacre.com] that they sold through Christian stores because Nintendo started to lean on retailers to stop them from selling unlicensed games.

There were even more primitive version

SCOTUS in Lexmark upheld interop post-DMCA

[tepples]

Even post-DMCA, circumvention involving copying a small amount of code for the sole purpose of interoperability is fair. Lexmark v. Static Control Components.

Re:

[dwywit]

Actual printed manuals. That brings back memories...

Microprose B17 Flying Fortress on 5.25" floppies, a foldout keyboard shortcuts guide, and a printed manual about half an inch thick.

Now I'm remembering the WordPerfect 5.1 manual.

Re:

[ihtoit]

I still play SU-27 Flanker. The original one. With the half inch thick manual.

(have a copy of Win98SE on Virtualbox just to run that and Homeworld 2 Complex).

Re:

[Rob MacDonald]

Chuck Yeagers air combat. First game I remember having "copy protection" that was literally a quiz before you could play, asking you a fact or detail that you'd have to open the game manual to the correct page to find. OR..... You simply keep resetting until you get a question you can answer from one of the many many military war planes trading card sets your wonderful grandfather gave you. Yup, I "cracked" chuck yeagers air combat by learning facts about the planes in the game.

Re:

[Miamicanes]

It's even older than NES. The **ATARI 7800** had DRM used to lock out unauthorized cartridges, and it was technically released around 1984 (though 99% of the 7800s sat in warehouses until the early 90s before Tramiel finally dumped them on the market).

Re:

[Miamicanes]

Actually, I vaguely remember that even the TI-99/4A had some kind of DRM that prevented most thirdparty software from running on it. I've never fully understood why, but I think it was something like this:

* The CPU could only directly access 256 bytes of RAM. The remaining RAM technically belonged to the graphics subsystem.

* The CPU could only execute code from a ROM cartridge after the graphics subsystem authorized it. I think it was protected by a combination of aggressively-defended patents and some tech

TMS9918 != MC6847

[tepples]

The graphics chip in the TI-99/4A, ColecoVision, and SG-1000 was TI's TMS9918 [wikipedia.org]. The Tandy Color Computer (CoCo) had a different, less capable one: the Motorola MC6847. In high-resolution mode, the MC6847's graphics were conceptually similar to those of the Apple II: essentially bit-banging an NTSC signal through a frame buffer and relying on composite artifact colors. Compare CoCo graphics [blogspot.com] to the same game on the Apple II [mobygames.com]. You might have been thinking of the MSX computer, which also used a TMS9918.

The video

Re: TMS9918 != MC6847

[Miamicanes]

Hmmm, now I'm intrigued... did the CoCo have the same wacky way of addressing pixels (1 bit per 7 pixels to select red+ blue or green+ purple, then 7 bits to select one or the other, or white if two adjacent pixels were set, and the Venetian-blind ram addressing)?

Also... what did an Apple II do if you had two adjacent bytes... one with the msb set, one with the msb clear, and set the rightmost pixel/bit of the first byte, and the leftmost pixel/bit (bit 6) of the second byte? Did it make white, because you

Re:

[UnknownSoldier]

> Also... what did an Apple II do if you had two adjacent bytes... one with the msb set, one with the msb clear, and set the rightmost pixel/bit of the first byte, and the leftmost pixel/bit (bit 0) of the second byte?

FTFY. bit 0 is the leftmost bit, not 6. Remember the Apple displays bits in reversed order. :-)

Anyways, if you follow comp.sys.apple2.programmer [google.com] then it is trivial to try this with Michael's HGR byte inspector:
* https://github.com/Michaelange... [github.com]

Ctrl I
Ctrl J
Shift 7
Shift 8
L
Shift 1

Or you can d

Re:

[tepples]

did the CoCo have the same wacky way of addressing pixels (1 bit per 7 pixels to select red+ blue or green+ purple, then 7 bits to select one or the other, or white if two adjacent pixels were set, and the Venetian-blind ram addressing)?

No. As far as I can tell, the CoCo had 8-pixel slivers, always set to the blue/orange set (same as Apple II with bit 7 on). It just had 32 bytes across (256x192) instead of 40 (280x192), which means bigger side borders.

Also... what did an Apple II do if you had two adjacent bytes... one with the msb set, one with the msb clear, and set the rightmost pixel/bit of the first byte, and the leftmost pixel/bit (bit 6) of the second byte?

Something like that would set three half-pixels to "on", which makes the same color as one of the sixteen GR colors with three bits set (such as yellow). Bit 7 really controls whether the state changes on the rising or falling state of the pixel clock. If you've done any double hires on a IIe

Re:

[ncc74656]

Hmmm, now I'm intrigued... did the CoCo have the same wacky way of addressing pixels (1 bit per 7 pixels to select red+ blue or green+ purple, then 7 bits to select one or the other, or white if two adjacent pixels were set, and the Venetian-blind ram addressing)?

No, IIRC. It put all 8 bits on screen as pixels, and the 6847 used linear addressing. I seem to remember it didn't always give you the same colors; between two runs of the same program, you might get swapped colors that would be fixed by hitting

Re:

[StikyPad]

Back then, we called it "copy protection." Because that's what it was. DRM is to copy protection what a tree is to fruit. Or perhaps, as a better analogy, what Sony BMG CDs are to rootkits.

Re:

[Revek]

Terms change. They tried to make the games impossible to copy. Called it copy protection until someone came up with a new term, DRM. Tada! Didn't work, never works.

Didn't toilet tissue used to be call toilet paper.

Re:

[Rob MacDonald]

copy protection = DRM. DRM is short for Digital Rights Management, which is done via copy protection schemes.

Re:

[Lead Butthead]

Yep, had the DRM been broken when the Saturn still had games being made for it, that would have been a big deal.

23 years later? Meh. Just play a rom on a emulator. It upscales, loading times are non existent, can save the game when you want, can have the whole library on one SSD. Why doesn't this guy try to break DRM on systems in circulation?

You do know this isn't going to stop Sega's landsharks from invoking DMCA.

Re:

[spire3661]

This sort of thing is specifically exempted.

"Computer programs and video games distributed in formats that have become obsolete and which require the original media or hardware as a condition of access."

http://www.copyright.gov/1201/... [copyright.gov]

Re:

[ihtoit]

interesting... so anything from 2600 cartridges to floppy disks...?

Re:

[Lead Butthead]

This sort of thing is specifically exempted.

"Computer programs and video games distributed in formats that have become obsolete and which require the original media or hardware as a condition of access."

http://www.copyright.gov/1201/... [copyright.gov]

That has never stopped corporate lawyers before, and it'll be very expensive for him to prove himself right.

Re:

[spire3661]

He doesnt have to prove himself right, the opposing side has to prove he infringed. Generally speaking, it would start with a simple C&D, and then from there you can make the economic choice to pursue it or not. Considering there is no real money involved, its really not a big deal.

Just in case anyone read this comment seriously

[rsilvergun]

the Saturn is nowhere's near perfectly emulated. It is very, very well emulated by a program called SSF thanks to some chap in Japan, but there are significant limitations. It also doesn't upscale and needs a beefy processor to deinterlace. I don't want to make light of the achievement of SSF's author's. The Saturn is a nightmare featureing 7 or 8 different processors with cache ram all over the place. It's a minor miracle what's been achieved. It's still fantastic to see this. The Saturn had a vibrant and incredible library that's largely inaccessible, especially if you're not Japanese. The difficulty of emulation means almost nothing got ported (and many of the "Saturn" ports on Xbox Live/PSN are really Model 2 ports). I always thought it sad Sega couldn't monetize their Saturn back catalog (outside of a very short lived service in Japan for PCs based on a different emulator). I would kill to get Panzer Dragoon 1,2 & Saga on PSN/Steam.

Re:

[Anonymous Coward]

SSF only takes actual discs because the author doesn't want anybody to use it to play pirated games (although everybody uses something that fakes being a disc drive instead). I don't think the author will want to release the source code out of fear somebody may modify it to take ISO files :P (also, the developer is Japanese, and they tend to be a lot more closed over their stuff too)

Re:

[catmistake]

Apprently, Sega Saturn is also emulated with MESS [reddit.com], part of the hugely successful and popular MAME project.

Re:

[ausekilis]

Don't forget about Yet Another Beautiful and Underrated Saturn Emulator [yabause.org]. I've used this a few times and it has done fairly well in the games I did try.

Re:

[evilviper]

I would kill to get Panzer Dragoon 1,2 & Saga on PSN/Steam.

Besides the Sega Saturn, Panzer Dragoon was released on R-Zone, Windows PC, PlayStation 2, and as a bonus in sequel Panzer Dragoon Orta for Xbox. Is there some reason you just have to have the Saturn version of the game?

Re:

[AmiMoJo]

There was the NC1 PCI card, which was basically half a Saturn. There were some Saturn ports for it, but this was back in 1995... I doubt any of them will run on modern systems.

The Saturn was a great system. Lots of amazing 2D and hybrid 2D/3D games, as well as the odd full 3D gem. I've still got mine, complete with RAM pack and mod chip, but I do worry that the CD ROM will eventually fail. Hopefully this guy will have a solid state replacement available by then.

Diamond Edge 3D NV1

[HalAtWork]

I think you mean the NV1, which shipped in the Diamond Edge 3D. Many ports were based off of this software. It used quads and spheres to render instead of triangles, close to what the Saturn did.

Re:

[jonwil]

The people on the MAME team who work on the Saturn driver would disagree that the Saturn emulator is anywhere near perfect. No emulator currently emulates the co-processor used for the control of the optical drive. (as far as I know the only people who have dumped the internal code of this chip haven't released it to anyone else)

Re:

[Anonymous Coward]

Please ignore the username above, I forgot to check AC.

Wrong, wrong, wrong, WRONG!

[Anonymous Coward]

The "DRM" (anti-copy protection) was circumvented decades ago, and modchips to perform that function have existed since that time. This is nothing new.

What James figured out was how dump the internal ROM of the CD controller MCU. This in no way "breaks" the copy protection, though it provides useful information about how the MCU works. Keep in mind that he is hoarding *ALL* of this information and has *NO* intention to share it with the public, for example to improve Sega Saturn emulation.

He is selling a mass-produced product to play games on the Saturn over USB and withholding information so nobody else can compete in that market.. This is a Slashvertisement and nothing more.

Re:Wrong, wrong, wrong, WRONG!

[Anonymous Coward]

In a forum post yesterday, he stated that he will include a CD Block firmware dumper as part of the finished product. That way he (in my words) doesn't need to care about the legality of sharing the ROM images that he personally dumped, and rare versions can be dumped without having to ship rare consoles around the world. So you can stop this conspiracy theory bullshit already. He has also been working directly with the Yabause team to improve their emulation.

Re:

[SumDog]

Did you...did you watch the video?

He's already contributed tons to existing emulator projects and posted a lot of his stuff up on the Saturn emulation boards.

He hasn't released his rom dump yet, but I have a feeling he'll release the tools for people to dump it themselves once he gets his product into production.

He didn't just circumvent the DRM using a device that you have to solder between the CD drive and the I/O connectors; he cracked open the dedicated CD controller, which had been a black box up until

Re:Huh?

[Z80a]

"News for nerds".

Scam artist

[Anonymous Coward]

Just a reminder: this guy is a slimebag who refused to share the Saturn SH1 ROM dump with MAMEdev so that he could commercialize this.

He's basically a scam artist.

So obeying copyright law makes you a slimebag?

[Ungrounded Lightning]

Just a reminder: this guy is a slimebag who refused to share the Saturn SH1 ROM dump ...

So, in your opinion, choosing not to voluntarily help out a project by violating copyright law (and risking mill-of-the-gods grade legal retribution) makes one a "slimebag"?

I did this years ago

[Anonymous Coward]

When I was in high school I did this with a bit of tape. Trick the system into thinking the lid was closed. Start legit game, let it spin twice, swap legit disk with CDR. Play

Super cool, but a little late

[jandrese]

While this workaround uses a very novel technique and had the side effect of giving the emulation community a chance to properly emulate the CD control chip, there is already a SD-Card based modchip that plugs into the CD-ROM drive slot and allows you to play games even if the optical bits fail. It works by emulating the CD-ROM hardware instead. Still, this modchip is better because you don't even have to crack the lid to install it, it simply slots into the MPEG card slot built into the console.

do you math

[Anonymous Coward]

23 years ago would be July 1993. That's a 16 month difference.

If it didn't cost a jillion dollars, I would buy 1

[drinkypoo]

I've got a Saturn here, and I've got some decent games for it. It's still IMO the best light gun platform. I've even kept an analog TV around for the purpose...

Thing is, devices like this for consoles tend to cost hundreds of dollars, and it's hard to imagine getting more enjoyment out of it than buying four or five new games, or eight to ten slightly older ones on sale...

Did this editor finally clean up his/her/its act?

[rebelwarlock]

When I saw BeauHD had posted this, I expected a link to some unrelated Apple bullshit at the end of the summary.

Bless you Slashdot

[uCallHimDrJ0NES]

This news made my day, and the comments were fun too.